Extracted

• • Target
    0B82B7C4AD21F54E62C93B8976E62726.exe
  • Size 2.1MB
  • SHA256 d8ae95705379f6f0233c294d5d9d841ebccb6dae75736aadd0ff25d6d350b9ed
  • MD5 0b82b7c4ad21f54e62c93b8976e62726
  • SHA1 027356938e96642c6bbde4c24b99bf78db6052e7
  • SHA512 17c32b7b1a99b322eef7b95d119a6b91e38d1bf2dcbf54ee187063ae86e93ddd272ac302c15969181550ee6f8d20037775b2cea790fb4882f38f06c4048cd00d
  • SSDEEP 49152:IAR6pHImCXi45lSevpEiegzoQ49aXZmMAGWaoDuNvaUtDaXmpIW51I:IwI7Wl5Yei1LQ49unkuwUtYq51I
  • TLSH
    T100A50133B5E28533EAB640B02E541B469FBFE6320438CC5B97D86D496764DC3E61A393
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  backdoordiscoverydonutloadergh0stratpurplefoxvalleyrat_s2loaderpersistenceransomwareratrootkittrojanupx

  • Detect PurpleFox Rootkit

    Detect PurpleFox Rootkit.

    rootkit

  • Detects DonutLoader

    loader

  • Detects ValleyRAT payload

  • DonutLoader

    DonutLoader is a position-independent code that enables in-memory execution of VBScript, JScript, EXE, DLL files and dotNET assemblies.

    loaderdonutloader

  • Donutloader family

    donutloader

  • Gh0st RAT payload

  • Gh0strat

    Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.

    ratgh0strat

  • Gh0strat family

    gh0strat

  • PurpleFox

    PurpleFox is an exploit kit used to distribute other malware families and first seen in 2018.

    rootkittrojanpurplefox

  • Purplefox family

    purplefox

  • ValleyRat

    ValleyRat stage2 is a backdoor written in C++.

    backdoorvalleyrat_s2

  • Valleyrat_s2 family

    valleyrat_s2

  • Drops file in Drivers directory

  • Sets service image path in registry

    persistence

  • Executes dropped EXE

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in System32 directory

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2